CVE-2019-7939: XSS
A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.
Other sources
PRODSECBUG-2370: Reflected cross-site scripting on customer cart page
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7939?
CVE-2019-7939 is considered a high-severity vulnerability due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2019-7939?
To fix CVE-2019-7939, update Magento to versions 2.1.18, 2.2.9, or 2.3.2 or later.
Which versions of Magento are affected by CVE-2019-7939?
CVE-2019-7939 affects Magento 2.1 versions prior to 2.1.18, 2.2 versions prior to 2.2.9, and 2.3 versions prior to 2.3.2.
How can CVE-2019-7939 be exploited?
CVE-2019-7939 can be exploited by sending a victim a crafted URL that executes malicious JavaScript in their browser.
What type of vulnerability is CVE-2019-7939?
CVE-2019-7939 is classified as a reflected cross-site scripting (XSS) vulnerability.